Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via Form Submission File Field
- ID
- WPSEC-2026-2733
- Plugin
- Drag and Drop File Upload for Elementor Forms (drag-and-drop-file-upload-for-elementor-forms)
- Affected
- from 1.5.5 before 1.6.3
- Remediation
- Update to 1.6.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-08
- Attack surface
- Drag and Drop File Upload for Elementor Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Deletion via the file upload field's submitted value in all versions from 1.5.5 up to, and including, 1.6.2. This is due to the remove_files() cleanup routine, which runs when the field is set to not save files on the server, deleting the paths recorded from the submitted file names without checking that the files were uploaded through the field or that they stay inside the upload folder. This makes it possible for unauthenticated attackers submitting a form with this option enabled to delete any file in the plugin's upload folder, including files other users submitted and its protection files, and on Windows hosts files outside that folder.
References
- https://wpsec.com/vuln/WPSEC-2026-2733/
- https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.3/
- https://wordpress.org/plugins/drag-and-drop-file-upload-for-elementor-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS